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WHY ARE WE TEACHING THIS?

 

 

° 5 Pillars of IO:
— OPSEC
— lVllLDEC
— lVllSO
— E W
— CNO
° The next major conflict will start in cyberspace
— Whether we recognize the signs is another matter
— Recent conflicts have already shown the importance of CNO (Russia/Georgia)

— Think China will make a move on Taiwan without bringing down their communications
networks?

- As lW officers (or DC) — we are expected to know and understand
CNO and communicate with decision makers

- Recently announced plans from Command in Chief and Pentagon
officials emphasize cyber space operations

° Basic 1810/IDC quals are a good foundation, but CO/XO want you to
know more about CNO
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Course Overview

 

 

Wednesday, April 1 1 th
Location: OPSZB

2341 1 8-1
m T 09 'c Briefer
0730-0900 CNO Intro/ TAO Overview LT -/ CTN1 -

CTN1 —/ CTN2
0900-1 000 Analysis -

CTN1 _ / CTN1
1000-1 1 00 EAO -
1100-1200 Lunch
1200-1300 [OD/Scanning CTN1 -
1300-1400 DNT ENS _
1430-1500 TAO Brief/Tour ENS -
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Course Overview

 

 

Thursday, April 12th
Location: OPSZB 234118-

3
Time To ic Briefer
LTjG-/ LTjG-
0800-0900 CND Intro/Threat Brief (S:—' U:
CTN2_/ CTN2
. _ (S: -
0900-1000 REd Team Brief  U: —
)
LCDR_ (s: -
1000-1030 Blue Team Brief -; U:—
CTRl Brown/ CTRl
1030—1100 jCMA Brief —(5.- _-
U:_)
CTN2 _ (S:-
1100-1130 Hunt Brief -,- U:—
)
1130-1300 Lunch

 
 

CTN2 - (s: -
' U:
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Course Overview

 

 

Friday, April 13th
Location: OPSZB

 

 
 

2341 1 8-3

m M Briefer
—POD CTN2_
0900-1 000 000 LTjG -
1 000-1 1 00
1100-1200 Lunch
1200-1400 PKC/PKI (Asymmetric Encryption) LT-
1400-1430 Debrief/Discussion LT -
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- Direct and synchronize actions to detect, analyze, counter and
mitigate cyber threats and vulnerabilities

.1

 

- Protect critical missions, enable freedom of action in cyberspace
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Network

Defense
Operation 5:

 

- Flexible response, incorporating Title 10 and Title 50 authorities,
to defend the GIG

 

 

Responsible Organizations:
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- Enabling and attack effects in cyberspace

 

 

- Support national and CCDRs’ objectives via cyber actions
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- Remote Operations Center, civilians and military personnel

 

 

- Enables active defense against cyber actorsfadversaries
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Summary
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Joint Cyber Attack Team
NCAT Vision
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Develop network
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Concept:

° TAO recently completed a major effort to align resources from
R& T, ROC, DNT and MIT into mission focused teams.

0 Mission Aligned Cells

— Teams composed of operators, analysts and developers working together to focus on
a specific target set.

- Allows TAO to efficiently resources on high-priority projects and
targets.

Current MAC’s:

° China/North Korea (NSA W, NSAH)

- Iran (NSA W, NSAG)

° Russia (NSAW, NSAH)

- Cyber Counterintelligence (CCl) (NSA W, NSAG, NSA T, NSAH)
° Counterterrorism (CT) (NSA W, NSAG)

° Target Service Provider (TSP) (NSAW, NSA T)

° Regional Targets (RT) (NSAW, NSAT)

 

 

 

Leadership Positions:

 

 

I RDML —

l l ‘ I - Deputy Chief, TAO

CAPT—

- TAO Cyber Operations Integrated
& Lead (COIL)

Staff (2/2/0) - Principle advisor to TAO leadership
for operational cyber issues

 

 

[Billet Description (BA/COB/Deployed)]

 

 

Leadership Positions:

LCDR —

° D/Chief, CT 8: Afghanistan

LCDR _

- In training — slated for Hard Targets Division, DPRK
Branch

LT—

° CNO Coordinator — China/DPRK Branch

 

 

Requirements &
Targeting

 

 

 

$327:
R&T Influence (8/6/0)
Endpoint Exploitation (57/35/0)

[Billet Description (BA/COB/Deployed)]

 

 

 

 

 

Remote
Operations
Cenier

 

 

 

%

ROC Influence (9/9/0)

Lead (3/3/0)

Interactive Operator (49/26/0)
Production Operator (25/14/0)

[Billet Description (BA/COB/Deployed)]

Leadership Positions:

CAPT _

- Deputy Chief, ROC

LCDR _

- D-Chief, STO

LT—

- Chief, Iran MAC (IMAC)

CTNCS _

° ROC SER

LCDR —

° Chief, Cyber Operations Branch

LTJG—

° Tech Lead, Cyber Operations Branch

 

 

Leadership Positions:

LT-

‘ ° Chief, Cyber Technologies Branch

° Chief, Engineering Services Division

 

 

 

 

 

 

5323:

Development (Officer) (2/2/0)
Development (Enlisted) (16/6/0)

[Billet Description (BA/COB/Deployed)]
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Leadership Positions:

LT—

° Chief, Operations Branch
Access

Technologies&
Operaiiuns I l

o D—Chief, EAO
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ATO (Officer) (4/4/0)
ATO (Enlisted) (23/15/1)

[Billet Description (BA/COB/Deployed)]

 

 

 

$325 - Mission Inﬂastructure Technologies:
Infrastructure (Enlisted) (7/1/0)

S352 — Global Access Operations:
Global Access (Officer) (0/1/0)
Global Access (Enlisted) (1/1/1)

 

1D mm

Officers“e

Enlisted

° 182 BA /101 COB = 55%

[Billet Description (BA/COB/Deployed)]
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operations
ALL
Operators Ops Conducted
All 208 100.00% 2588 100.00%
CIV 70 33.65% 1059 40.92%
NAVY 52 25.00% 674 26.04%
AF 44 21.15% 343 13.25%
ARMY 29 13.94% 376 14.53%
USMC 11 5.29% 108 4.17%
USCG 2 0.96% 28 1.08%
NAVY
Operators Ops Conducted
NAVY 52 100.00% 674 100.00%
NIOC-M 28 53.85% 292 43.32%
NIOC-T 10 19.23% 133 19.73%
NIOC-G 8 15.38% 107 15.88%
NIOC-H 6 11.54% 142 21.07%

 

 

 

 

 

 

Target Sets - R&T
Analysts

China

Russia

Iran

Afghanistan

Pakistan

India

Iraq

Counterterrorism

Cyber

CounterinteIIigence (CCI)
Supporting Roles

ROC Senior Watch
Officers

Development

Tar at ' u '

MAC: Mission Aligned Qell — puts analysts and operators together to increase target familiarity and
efficiency of operations
' Joint military and civilian entity

 

 

   

m - “t,
can —l-'-------'

 

 

 

° Current TAO Targets

— Political

- _leadership to include Ministry of
Interior, Parliament Members, and
Presidential Palace

— Military
- Former Commander of - Common Border

Force—

- Col.—--IT Directorate
- Gen.—-MedicalComman

- Gen.—- (affiliation unknown)
- Col. —- Instructor, Army Staff

and Command College

- Lt. Col.—— Defense Ministry

- Recent Reporting

— _ Armed Forces Reviewed
Personnel Issues Regarding Retirement,
Communications, and Health Care
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J Unix and Windows Operators:
ExplpilerQualilied
(Minimum Requirement)
Routerand Firewall Operators:

May shift between CTE'S depending on
operator specialty and mission requirement

\

 

\.

/.

—C.'IE—'
mm

2 Basic
Operators

2 Windows
Operators
ﬁ—_
0 erator ys

2 Unix
Operators
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[CAT Concept of Current Navy Participation:
gm ° Mission Commanders:

' Assembled for Title 10 . LUG-

eXeCUtiOn support - Qualiﬁcation based on 105 administered

' Mission Commanders and by the C yber Operations Branch
Operators provide full- ° Five (5) additional officers in training
time support to CNE ' Operators: I n n
  or ° 22222:: 22222222222222
JCAT ' REQUires LOAC/ROE Briefing and Tool

Training

Requirements:
° CA UI Support

- 1 Mission Commander
o 2 CNA Operators

° TASKORD 11-0335
- 3 Mission Commanders

Information Technology

Direoto . to [ITD  _  E: E
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AUTEC testing with USS Annapolis. 18 NOV 2011

- Interactive Operations - Man On the Side

— Connection via: Operations

NEP TUNE THUNDER - -

’ — Inject usmg:

BL’NDDA TE/HAWYHOUR BLINDDA TE/NITESTAND
— Successful eprOIts at 4, 6, . .

and 8 NM with 4 watt — Successful Inject at 4 NM to

Access Point (AP) 100 mw client computer.
— Predict max connection

distance to standard 100
mw AP to be 4 NM.
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Network Operations - Overview

Overall classification of this brief is:

Derived Prague-3337A? mm.

Dgciassimef-baggagéﬂ

 

 

 

 

 

 

 

Networking Fundamentals

 

 

0 Describe the following network component/terms:

— Proxy Server:

- An intermediary computer that completes application network requests on behalf of a
host

— Router

- A layer 3 device used to route traffic between networks
— File Server

- A server dedicated to the hosting and sharing of files.
— Perimeter Network

- The network segment located between LAN and Internet, used to place Internet facing
services like Web and Mail Servers.

— Internet
- The aggregate of publicly connected networks implementing the IP addresses
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Networking Fundamentals

 

 

0 Describe the following network component/terms:

— Intranet
- A private network not normally accessible through the internet.
— Firewall

- A mechanism to filter network traffic using rules based on attributes like source,
destination, packet type, port, and session status.

— IDS (Intrusion Detection System):
- Network traffic analyzer that uses patterns to detect malicious activity.
— TACACS (Terminal Access Controller Access Control System).

- Provides authentication, authorization, and accounting control to network devices via
central server.

— RADIUS (Remote Authentication Dial In User Service)

- Authentication protocol for remote users to access network resources via network
access methods like Dial-in, VPN, DSL, and WAP.
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Networking Fundamentals

 

 

° Define the following cross domain solutions:

— High Assurance Guards

- Connects networks operating within different security domains. Filters traffic like a
firewall but operates on all levels of the TCP/IP stack.

— SABI (Secret and Below Interoperability)

- Connection of Secret Security Domain to Security Domains of lesser classification
levels.

— TSABI (Top Secret and Below Interoperability)
- Connection of Top Secret Security Domain to domains of lesser classification levels.
— Bastion Host

- A host on an internal network that is also publicly exposed to the Internet or another
public network. Usually used for service hosting (web, email, etc) or as part of a
firewall solution.
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Networking Fundamentals

 

 

° Describe the location of the following components in a simple networked
environment:

Proxy Server
Router
Firewall
Workstation
DMZ

Switch

DMZ Segment

   

3999.939:

  

Internal
Network

a.
“‘ \u
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Wireless Networking

 

 

0 Define wireless networking to include the following aspects:

— Wireless Access Point
- Wired to Wireless bridging.

— 802.11 Protocols
- The set of layer 1 & 2 protocols defining the RF physical layer and media access

 

control.
STANDARD Frequency Range Modulation Method Bit Rate .
— 802.11a 5.0 GHz OFDM 54 Mbps
— 802.11b 2.4 GHz 0888 11 Mbps
— 802.11g 2.4 GHz OFDM 54 Mbps
— 802.11n 2.4 or 5 GHz SDM 600 Mbps

- Other wireless technologies in the 2.4 GHz range include Bluetooth (802.15), cordless
phones, microwaves, baby monitors, etc...

— MAC Filtering
- Only defined hardware addresses can connect to network
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Networking Fundamentals

 

 

° Define the following application protocols/services and identity their port
numbers:

— Telnet: TCP 23
— NTP (Network Time Protocol): TCP/UDP 123

— NetBEUl (NetBlOS Extended User Interface): Non routable transport protocol used in pre-
WinXP LAN’s.

— Net BIOS (Network Basic Input/Output System): TCP/UDP 139
— FTP (File Transfer Protocol): TCP 21
— POP3 (Post Office Protocol 3): TCP 110
— RPC (Remote Procedure Call):
- SUN/UNIX: TCP 111, 32771
- WIN: TCP/UDP 135
— HTTP (Hypertext Transfer Protocol): TCP 80
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Networking Fundamentals

 

 

° Define the following application protocols/services and identity their port
numbers (continued...) :

— SM TP (Simple Mail Transfer Protocol): TOP 25
— DNS (Domain Name System): TCP/UDP 53
— SNMP (Simple Network Management Protocol): UDP 161

— SSL (Secure Socket Layer): Presentation Layer protocol for use by applications to secure
communications

— SSH (Secure Shell): TOP 22

— TFTP (Trivial FTP): UDP 69

— HTTPS (HTTP Secure): TOP 443

— FTPS 0:

— DHCP (Dynamic Host Configuration Protocol): UDP 67

 

— NA VlOCOM M land Center of Excellence for Non-Kinetic O tions —
b 36

 
 

Network Layer Protocols

  

 

 

° Define the following network layer protocols to include their relationship to
TC P/l P:
— IP
- Layer 3 (Network) used for network addressing and routing
— TCP
- Layer 4 (Transport) used for application session and reliable delivery
— UDP
- Layer 4 (Transport) used for application communication.
— ARP
- Layer 2 (Link) used for Mapping IP addresses to MAC Addresses
— RARP
- Layer 2 (Link) used for Mapping MAC addressees to IP Addresses
— ICMP
- Layer 3 (Network) used for Network Diagnostics
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08! Model

 

 

0 List and describe the 7 layers of the OSI Model:

Lﬂ'flf H-IH'IE- Liw Hun. Funetiu-n Exian
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Fra'lliders FIE-Innth and Unreliable TIC-'F'
L'l-EI war? Mid! Err I'_'|r ljl'Jfrl'EETIﬁll UDF
Data -
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H Uﬁﬂﬂ b'Ir Flume-1'5
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TCP/lP Model

 

 

0 List and describe the 4 layers of the TCP/IP Model to include how they

relate to the OSI Model:

— The TCP/lP model combines
the Session and Presentation
layers with the Application
layer. It is assumed if a
program has need of layer 5 or
6 functionality, then the
program Will have to provide it.

TCPi'IP

 

APPLICATIONS

OSI

 

Application Layer

 

Presentation Layer

 

 

TranSport Layer
TCP and UDP

Session Layer

 

 

Network Layer
IFI

TlanSpOYI Layer

 

 

Data Linit Layer

Network Layer

 

 

 

Physicai Layer

Data Link Layer
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Physicai Layer

 

 

 

TCP 3-Way Handshake

 

 

° Define and illustrate the TCP 3-Way Handshake

— The 3-Way handshake is the method
that all TCP sessions use to initialize

 

 

 

connections and session parameters. It Cﬂmhm'ter A SENS '3 Carnelith
evnc I'IEII'IIIB MESS-HEB - EH3 I'I-EI-WE Q'ES
fOIIOWS the_sequence SYN: SYN'ACK:_ tc E containing a that it received
ACK. Application data can begin sending sequence number the measace In
Eeu=lﬂﬂ- Incremuntmg

with the final ACK packet.

the sequence
nLIrnbeHcelle-j
an "AEK'H. Italeo

 

Ccmputel A neceivee sends its even
the Act: it euc-ecte and sequence,-
the connection is new ace=1ﬂ1.5yn=3nﬂ_

established-

.I'-'t|| cummunicaiiun WIII --——-+
new sen-cl incremented
sync and acts to eneme
a good ccn necticn.‘
evn=1ﬂ2, aclt=3ﬂ1.
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TCP Flags

 

 

0 Define and briefly describe the use of the following TCP flags:

— SYN: Used to initialize the TCP by setting the packet sequence number
— ACK: Used to acknowledge receipt of all package sequences up the number indicated

— PSH: Indicates that that all data already received should be given to the application as soon
as possible. Flushes the buffer.

— URG: Urgent Data. Commonly used for interrupts.

— FIN: Indicates there is no more data to send from that end of the connection. Session
closes after both ends acknowledge Fle

— RST.‘ Immediate termination of connection. Commonly used to indicate unavailable
service.
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Protocol Headers

 

 

Define and describe the structure of the following protocol headers:

 

 

 

 

 

 

 

 

 

 

 

 

— [P 1] 15 16 ___ __ _ 3-1
4-bit 4-bit header 3-bit type of serVic-L- . -
“Emmi Imam tm} Jﬁrbtl Imalu tangth {In bytes}
. . . . 3-bit I . _"
“Hint Ldﬂnhﬁmhun . l3~btt t'ra vent offset
ﬂags 1 gm
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|
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1 data ,3
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Protocol Headers

 

 

Define and describe the structure of the following protocol headers:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

— TCP n 15 1t:- 31
T
16-bit mum:- port number mutt destinatiru'i port number
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Protocol Headers

 

 

0 Define and describe the structure of the following protocol headers:

 

 

 

 

— UDP
n 15 15 ___ I :n
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MAC Addressing

 

 

0 Discuss the following as it pertains to MAC Addressing:

— LENGTH OF MAC ADDRESS IN BITS: 48

— DISPLAY OF MAC ADDRESS: Hexadecimal Format 00:8e:f0:59:31:ae
— LOCATION OF MAC ADDRESS: First 48 bits in message

— MANUFACTURER SPECIFIC BITS: First 3 Octets

— HOST SPECIFIC BITS: Last 3 Octets

'Jlll

HI tﬂtrl L-"|1tl:'!I'.l-:l_ 3r:| nilL-I -1-‘I1 t'ﬂtrl hlit nth-l “I31 (Flu-I
"I2.IIH't_I=l ;_ :JIIIIUIILH _ HIHJIII'I [JHIH'EH _ illtlmlﬂl _ [JIII'HJHII

f'n'l [-'|Il£l|'.-'|I'lII'LI'l-lHl-II] !1:!

II‘..'I [tllnhalIIﬂ-mi} m
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ARP

 

Discuss the following as it pertains to ARP:

— ADDRESS RESOLUTION.”

- ARP (Address Resolution Protocol) facilitates the mapping between hardware
addresses (MAC Address) and logical network addresses (IP Addresses). This

mapping can be stored in a file or can determined through ARP broadcast requests on
a local network.

 

— NA VlOCOM M land Center of Excellence for Non-Kinetic O tions —
b 46

 

ICMP

 

 

0 Discuss the following as it pertains to ICMP:

— ICMP is a protocol that defines a collection of message types commonly used for network
diagnostics.

- Layer of the OSI model: ICMP (usually) consists of Layer 3 (Network) messages
transported by IR

- Ping: Message Type 8 (request) and 0 (reply). Used to determine if a device is active
on the network.

- Traceroute: Uses a combination of the IP time-to-live (TTL) field and the ICMP
messages 11 (time exceeded) and 3.3 (port unreachable) to determine the route a

packet takes through the network.
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Routing Table

 

 

0 Discuss the routing table as it pertains to the router:

— The Routing Table Stores What networks are reachable through each interface along with
metadata about that route.
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lP Addressing

 

 

0 Discuss the following as it pertains to ranges of IP addressing:
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- Ciassfui networks were the original method of
distributing address groups to organizations.
. . SEEM I] + Elm; E Address.
- Class A: First 8 bits for Network ID and the last “"3
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- 126 Networks: 16,277,214 Hosts/net

 

- Class B: First 16 bits for Network ID and the last
16 bits for Host ID.
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TCP/IP

 

 

0 Discuss the following as it pertains to TCP/IP:

— Number of bits in an IP address: 32
— Number of octets contained in an [F address: 4
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- va6 has 128 bits, roughly a 300 trillion 300 trillion more
— 90, 000, 000, 000, 000, 000, 000, 000,000,000 times the space of in4
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Networking Fundamentals

 

 

° Discuss the following as it pertains to the following protocols:

— TCP
— UDP
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lP Subnets

 

 

0 Discuss the following as it pertains to IP Subnets:

— Number of bits used in a subnet mask.

— How the subnet mask identifies the network portion of the of the IP address.
— Borrowing bits from the host portion of the address.

— Benefits of subnetting.
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TELNE T

 

 

0 Discuss the following as it pertains to TELNE T:

— Use: Create a Network Virtual Terminal session on a
— Type of connection: TELNE T uses TCP as the
— Default port number: 23
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Questions

 

 

° Questions?
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